I have lost all trust in GitHub, and not because of the vulnerability, but because of their response. With their suspension of hamakov's account and deceptive blog post about the extent of the hole, GitHub has guaranteed that they won't be the first to know about the next vulnerability (and there's always another).
I've downgraded my paid account to a free account, and won't keep any non-public data on GitHub in the future. I had a similar response with my (non-paid) DropBox account. I guess I didn't rationally evaluate cloud resources, and have trusted far too many people.
The way GitHub reacted (blocking @homakov) is just wrong and destroyed all my confidence in them. Even more so when it was pointed out that @zedshaw crashed GitHub and didn't get blocked. http://sheddingbikes.com/posts/1306816425.html
Edit: Given that they have now stated that suspending @homakov was only temporary I no longer bear any ill will towards them.
I'm still disturbed by their security practices though. I expected better by the github guys and I don't like what this implies about the rest of their App.
(And yes I am using attr_accessible and not attr_protected since its inception)
Oh wow, that nickmartini story is really something. Trolling through github ? Just sad.
And github forgetting the block user functionality makes me think they don't want to listen to user needs. Sure, it may not be a very popular request, but I bet for a minority it's the most important.
It is rails guys, not ruby guys. I am still wondering why people can't distinguish two different communities. You don't mistake python and django or php and kohana or java and strut, right?
It doesn't work that way. Rails is a major reason for the kind of push Ruby got.
There was a time when CGI and Perl were synonymous. You won't believe how many people have a similar opinion about JQuery and Javascript these days.
A few days back I wanted to use a object oriented language for a big project. Generally I straight away go and use Perl for all my experiments. But since this time I wanted Java programmers to be working with my project later I thought let me use Python as its more syntactically closer to Java. When I started coding, my manager peeked over my shoulder and asked if it was Python in which I was coding I replied yes. He immediately asked me to stop writing in it, as he thinks writing in 2.x is waste of time as it is going to go away, 3.x is not yet having all the libraries. And writing 2.x will force a huge rewrite effort later. I tried and reasoned enough to convince other wise. But alas, it didn't fly.
That is how it works with pointy haired managers. They read something some where and then hold strong opinions about a particular technology.
As programmers we can try and educate people in forums like these.
But managers don't read these forums. They are likely to read magazines from IBM and Oracle, where XML's are glorified and eclipse is presented as the biggest productivity booster ever. Unless we get a forum on such magazines, we won't be able to make much difference.
You're right of course. I've honestly been trying to avoid the Rails community for as long as possible (I'd like to avoid being associated with anyone who would call himself a "Rockstar Programmer"), and with Rails being as big as it is, I've pretty much avoided Ruby entirely.
Ruby community is quite reasonable. I usually avoid discussions in framework communities. At the other hand, programming language communities tend to be more reasonable and nerdy. I feel bad that you missed the chance to know ruby language due to anti rails.
I've coded in Rails since forever (0.5) and I honestly don't see how that dongml thing is funny. I'm not even able to understand how it is supposed to be funny, is it the dicks?
For sure I think that a language shouldn't be avoided for something different than technical reasons, and nothing else.
I code a lot in Ruby and have never touched Rails... Initially I got into Ruby because metasploit is written in it. Ruby might be popular because of Rails but it is not relevant to everyone who codes in Ruby.
I think this Depends on the country or language somewhat too - many ruby guys in Japan are another breed entirely (using it as a playground for esoteric languages, quines..)
They suspended the account, they didn't cancel it. On a Sunday morning when you're fixing a security hole and you know who penetrated it you suspend that person's account. On Monday morning you figure out what to do with them.
"On a Sunday morning when you're fixing a security hole and you know who penetrated it you suspend that person's account."
Haha what. Do you maintain any sites? Tell us what ones. I want to warn all of your users that the admin is someone who will disable an account of someone who committed to master on a project that is not theirs and feel he has accomplished something.
We suspended it after fixing the bug to make sure he didn't retain access to something he shouldn't. We rarely do this, but he wasn't upfront with everything he was doing on the site like people that disclose vulnerabilities responsibly.
Oddly, I don't feel that GitHub is being upfront with everything that's going on here. It appears to be a very complicated story, but it was presented in an entirely different manner. I recognize that it's difficult to present a coherent story when everything is playing out in real time on the web, but the blog posts seem to have shared just the wrong amount of information.
> he wasn't upfront with everything he was doing on the site like people that disclose vulnerabilities responsibly
If he was, he wouldn't have really made his point, would he? There are a lot of other Ruby sites which have this sort of bug.
I actually do understand suspending his account, and I even kind of get the intentionally misleading communications (you have to keep the corporate customers happy, right?), but the new "white hat" policy thing is kind of silly, because that's clearly not what this was about.
Well, you should have just stated that in the first place instead of name calling and acting immature. A simple "we have suspended his account while we carry out further investigations, this is practice" would have gone a long way to ease people's minds and kind of reactions you got. Instead, Github just came across as massive douches.
EDIT: On second thoughts, I think I am being overly critical on all parties. Instead, I think I hands up "we messed up, but we are learning" approach would be better, and we see how both sides act if/when this happens again, lessons learnt and all that!
I'm just going to latch on to this comment to make mention of a GitHub alternative for private repositories: http://repositoryhosting.com/
I've been a happy customer for a while now, and have seen them recommended on HN many times. You get unlimited repositories with unlimited users for less than the cost of GitHub's cheapest 5 repo plan.
My open source code is on GH, but it's all also pushed to RH, along with all my private code.
IMO the best location for private repositories is your own equipment. Or rented equipment but with the private code and data on encrypted block devices or filesystems.
I know it can be a faf to setup proper reliable secure backups and so forth (though with git it shouldn't be too hard give the whole thing is designed with wide but efficient distribution in mind), but if you stuff is sensitive enough (in a business sense, some other financial sense, or for more personal reasons) to care about keeping private then I would think twice before trusting a third party with the data. No matter how trustworthy, reliable, and secure they try to be, every one makes mistakes.
Maybe I'm just paranoid. Or just plain old fashioned. But "everything in the cloud" just scares me. Keep public stuff on public services by all means, but keep your private stuff under greater control.
"No matter how trustworthy, reliable, and secure they try to be, every one makes mistakes." Which can include you. I get that it'd be pretty hard for anyone else to access code that is just on your own laptop plus encrypted off-site backup storage, but once you get to the point where you need to collaborate with other people and need some sort of a service available on the web, I'd put more trust in the security chops of a trustworthy third party than I would in myself.
What makes you think they are saints? About a year ago I discovered that they didn't protect attachments to tickets in private repositories (since fixed). Anyone who could guess the URL could access the content. (It looked like the cause was keeping the attachments in S3 without front-ending them.)
On contacting them I was told it would be fixed in a day or two, and that it was no big deal since you had to guess the URL. The values you had to guess in the URL were a ticket number (they start from 1), a repository name, a date (YMD) and a filename. Sure there is some variety in there but it is not in the billions of possibilities, just hundreds and that won't make any computer break into a sweat and in my words at the time "easy". To make matters worse you can't delete the attachments to tickets.
This may not affect you. It certainly affected me. For example we had some keyfiles in one ticket. Coredumps in others.
Two weeks later the issue still hadn't been fixed and I don't know when it was. I've never seen disclosure of the issue. There wasn't even any way of knowing if attachments had been accessed in an unauthorized way since there was no checking in the first place.
I prefer to pay someone to host the private repos. No free tier means every user is treated like a paying customer, and every user's data is considered valuable. It also means that as long as the pricing is sane, the company isn't going to shut its doors for lack of revenue. Before RH I was paying Springloops.
It's $6/month to take care of my most important assets. That doesn't even buy a meal at McDonalds anymore; it's worth it.
> as long as the pricing is sane, the company isn't going to shut its doors for lack of revenue.
BitBucket is owned by Atlassian for 2 years now and they don't look like they're about to go out of business ($60mil revenue in 2011, 400employees, worldwide offices). When they bought it, it was them who set private repos to unlimited (when @jespern was running it alone, it was set to 5), so I believe they know what they're doing and that it fits their business model. Over 5 collaborators need a paid plan and that's just how they set up the pricing scheme.
As far as I can see as an active user and lurking through their blog and bugtracker, BB is actively developped, so I assume you don't have to worry about them running out of business, looks like it's a valuable asset in Atlassian's software portfolio (at least valuable enough to work on it).
Except when they don't handle security well, and you end up with anybody that feels like it capable of reading your private source code... Like, say, NOW.
I used to use them years ago and it certainly wasn't issue free. When they took away their free private accounts it was a pretty big pain only to have them re-implement them less than a year later.
This is a perfect summary and exactly the sentiments that I couldn't express in the article. I've quoted you with attribution if you are okay with that?
This is probably the perfect time to switch to http://bitbucket.org/ . They offer free unlimited public and private repositories for both Git and Mercurial. However, the free private repositories are limited to five collaborators.
^ this, I just moved my prive repo to bitbucket hoping that Atlassian would have handled this issue better. At least they seem to have more experience looking at their long history in software. I will also look into setting up my own git(orious) server.
I personally know some people that work for Atlassian and they are awesome. Moreover, they really do care for their customers. I have no experience using Bitbucket, but given the people I know I would definitely trust them.
I have to agree that suspending the account was dumb as if he wanted to be malicious, he'd have created dummy accounts and would have committed malicious code to popular projects.
But then, going so far to say losing all trust in github.. there was a bug, it's fixed and they suspended the "attacker". I wonder what will happen in the following days with script kiddies trying to "hack" all rails website. In fact, isn't the overloading of parameters something as old as the earth that security experts would check first as a vulnerability?
Not to downplay the exploit at all, but for everyone raging that this occurred and are worrying about the integrity of their codebase, we are talking about an SCM for god sakes aren't we? Git is distributed and all most users would need to do who are freaking out right now about evil commits is to go back and audit your git commit history no?
I've downgraded my paid account to a free account, and won't keep any non-public data on GitHub in the future. I had a similar response with my (non-paid) DropBox account. I guess I didn't rationally evaluate cloud resources, and have trusted far too many people.